Data Protection

HC Deb 03 November 1987 vol 121 cc885-905 10.34 pm

The Minister of State, Home Office (Mr. Tim Renton)

I beg to move, That the draft Data Protection (Subject Access Modification) (Social Work) Order 1987, which was laid before this House on 21st October, be approved. It will, I hope, be for the convenience of the House if we take also the other three orders, Mr. Deputy Speaker: That the draft Data Protection (Subject Access Modification) (Health) Order 1987, which was laid before this House on 21st October, be approved. That the draft Data Protection (Regulation of Financial Services etc.) (Subject Access Exemption) Order 1987, which was laid before this House on 21st October, be approved. That the draft Data Protection (Miscellaneous Subject Access Exemptions) Order 1987, which was laid before this House on 21st October, be approved.

Mr. Deputy Speaker (Sir Paul Dean)

If the House agrees, so be it.

Mr. Renton

Before I come to the substance of the orders, it may be helpful to hon. Members if I say a few words about the background to the Data Protection Act 1984 and report on progress in its implementation.

The Act arose directly from our signature of the Council of Europe convention for the protection of individuals with regard to the automatic processing of personal data. Both data users, that is to say, those who hold and process personal data on computers, and data subjects, the individuals to whom the data relate, had a strong interest in seeing the enactment of domestic legislation in accordance with the convention. The data users were concerned that without legislation the United Kingdom would not be able to ratify the convention with the result that this country would be excluded from future international data flows, to the detriment of the business community here. To give an example, had the United Kingdom not decided to ratify the convention, multinational companies and other companies with international interests would not have been able to transfer personal data freely into the United Kingdom from other countries which had ratified; and if, as a result, certain personal data were no longer held in the United Kingdom, data subjects here would have had no right of access under United Kingdom law. Data subjects for their part were equally keen to have a statutory right of access to the data held about them, as the convention envisaged.

As some hon. Members will recall, the Data Protection Act was keenly debated in this House and in another place in the course of its parliamentary passage in 1983–84, and was subject to extensive discussion in Committee; there were no fewer than 25 Committee sittings. The legislation was duly enacted in July 1984 and an appointed day of 11 November 1985 was set. The newly created post of Data Protection Registrar was filled by Mr. Eric Howe, to whose work in implementing the Act I should like to pay warm tribute tonight. The registrar is independent of the Executive and reports directly to Parliament. His third report was presented to Parliament and published last July.

It was originally estimated that some 300,000 registrations of data users could be expected, and there has been concern in some quarters at what is seen as the serious problem of non-registration. I understand, however, that the position is not as unsatisfactory as has been made out. Research by the registrar now suggests that there are between 200,000 and 250,000 systems liable to registration, and so far the number of registrations stands at about 145,000.

I do not want to be complacent about this, and there is still obviously some way to go before we can be satisfied that the registration requirements are being properly met, but I would point out that our experience compares favourably with that of other countries. France, for example, after nine years of operation of its legislation has approximately 150,000 registrations from a pool similar in size to our own. A recent survey of registration in Austria, Norway and Sweden found that we had achieved a record number of registrations during our initial registration period as compared with these other countries.

The Government are conscious that the benefits conferred by the Act on data subjects are achieved to a large extent by requiring data users to take on additional responsibilities, including, in particular, registration and the grant of subject access, which have significant implications for them. That is inevitably a particular problem of small businesses. In an endeavour to relieve some of the burdens on such businesses, whose use of personal data bring them within the scope of the Act, the registrar has currently introduced and widely distributed a new simplified registration form, which is obtainable from Crown post offices. In just a month since the new form was made available, some 5,000 new applications for registration have been received. In addition, some 1,200 applications per month continue to be submitted using the old form. I am hopeful therefore, that the shortfall in expected registrations will before long be considerably reduced.

The registrar is investigating those whom he considers should have registered, but have not done so, and is ready to offer assistance and advice to those who are uncertain whether they are required to register. There is the ultimate sanction of prosecution for those who deliberately refuse to register, but I understand from the registrar that, in his view, the number of such prosecutions is likely to be small. There is certainly no intention of prosecuting people who are simply unaware of their liability to register.

The registrar is seeking to publicise the Act through advertisements in the media and professional journals. He has also published a series of guideline booklets, which explain the provisions of the Act in simple terms—not, I might add, an easy task. I understand that these booklets are in heavy demand. The registrar has also been active in promoting the publication of codes of practice relating to various sectors of data users, including, for example, the direct mail industry, travel agents, universities and polytechnics. Later this month, he is to undertake an advertising campain to inform the general public about the new right of subject access.

Subject access under the Act becomes available from 11 November. That important date marks the final stage of implementation of the Act. With its provisions fully in place, we shall be in a position to ratify the European Convention on 1 December, and we have already deposited our instrument of ratification with the Council of Europe.

After that brief sketch of the background, I turn to the orders before us, which, if they are to proceed, require affirmative resolution of both Houses. In describing to the House the provisions of the orders, I hope I may be forgiven if I do not use their full titles, but refer to them more shortly as the health order, the social work order, the financial services order and the exemptions order. That will save a little time, as the hon. Member for Birmingham, Erdington (Mr. Corbett) will agree.

All the orders modify in various ways the operation of the subject access provisions of the Act. Some hon. Members may wonder whether that is not a sort of backdoor method of limiting the right of access granted by the Act. I assure the House that that is by no means so. The Act recognises a number of exceptions to the subject access provisions, in relation, for example, to data held for the purposes of prevention or detection of crime, apprehension or prosecution of offenders, or assessment or collection of tax or duty. It also makes provision in relation to health and social work and financial services data for the Secretary of State, by order, to provide exemptions from subject access, or to modify the application of the subject access provisions in specified ways; and to prevent subject access to information which is protected from disclosure under other enactments. The areas covered by the four orders that we are considering are all, therefore, areas in which Parliament specifically envisaged that unfettered subject access would be neither practicable nor desirable.

I shall now say briefly what each of the orders is intended to achieve, beginning with the health order.

Section 29(1) of the Data Protection Act allows the Secretary of State to exempt from the subject access provisions personal data consisting of information on the physical or mental health of the data subject which is held by, or was recorded by or on behalf of, a health professional; or to modify the provisions in relation to such data.

The health order allows access to data relating to the physical or mental health of the data subject to be modified to enable a data user to withhold data that is likely to cause serious harm to the physical or mental health of the data subject, and data which would lead to the identification of another individual other than a health professional who has been involved in the care of the data subject. The general assumption is that data subjects will be provided in most cases with access to personal health information held about them on computers. Information will be withheld only on the advice of a health professional that the data subject could be seriously harmed by the information, or that the information would enable the data subject to identify another individual.

Mr. Archy Kirkwood (Roxburgh and Berwickshire)

I should like to ask a specific question which I think is implicit in the health order about which the Minister is speaking. What is the position if I ask my local health authority to let me see my computerised health record and the computer user, the health board, then seeks advice from my general practitioner about whether it is safe to allow that information to be transmitted to me without causing serious harm and injury? If my general practitioner is dilatory beyond 40 days about supplying consent to the computer operator to provide that information, does it follow that I will be given after that 40-day period unfettered access to that information?

Mr. Renton

To find the answer to his question the hon. Gentleman should look not at the health order about which I am speaking, but at the next one, the social work order. I refer him to article 4(3) and (4) in which he will find the answer to his question about whether under the circumstances that he postulates he would have access to the computer data.

Mr. David Ashby (Leicestershire, North-West)

Perhaps my hon. Friend could explain the specific point about computer records disclosing the identity of someone else. For example, if an instrument was left inside me by some incompetent doctor—and I accept that doctors are seldom incompetent—as often happens in this sort of litigation, there would be a great clamour because I knew nothing about the instrument. Could that be grounds for refusing to disclose the data information? What about the general practitioner involved? Would there be any appeal against his refusal?

Mr. Renton

The fact that a scalpel has been left inside my hon. Friend must first be registered on a computer before the orders that we are debating can become relevant. Secondly, the intrinsic point in these orders is that the information would be withheld only if it were thought that, by virtue of being told that he had a scalpel inside him, my hon. Friend would be likely to suffer a heart attack. As I understand the orders, under these circumstances it would be relevant to withhold the information.

Perhaps I could refer again to the question asked by the hon. Member for Roxburgh and Berwickshire (Mr. Kirkwood) and give him a little more information. It is clear under the orders, and particularly the social work order, that generally the health authority will not seek the views of the general practitioner, but only the views of its own consultants. Perhaps that gives added emphasis to the rather detailed question that the hon. Gentleman posed. Perhaps I could return to the first order. Its terms make it clear that only information that satisfies the criteria that I have mentioned—this goes back to the question asked by my hon. Friend the Member for Leicestershire, North-West (Mr. Ashby)—may be withheld, and data users will be otherwise obliged to supply as much information as can be supplied without causing serious harm to the data subject or enabling the identity of another individual to be disclosed or deduced. In those circumstances, where information is withheld the data subject will not be informed that information has been withheld since to do so could cause even more harm than would be caused by access to the information itself. Professional counselling may help to ensure that as little information as possible is withheld in line with the policy of the 1984 Act, which is concerned essentially with allowing, rather than withholding, access.

The second of these orders, the social work order, deals with data held for or acquired in the course of social work and modifies the subject access provisions in their operation in this area. Article 3 of the order specifies the data concerned broadly as those held or acquired for social work functions by Government Departments, local authorities and other specified bodies, including designated voluntary organisations of which the NSPCC and its Scottish equivalent are so far the only ones to have applied for designation.

The order does not apply to the subject's health data, to which the health order applies; that is to say to data held by, or consisting of information first recorded by, a health professional. The subject access provisions are modified to the extent that the requirement to supply information is disapplied when to do so would he likely to prejudice the carrying out of social work in that there was a real risk that serious harm would be caused to the physical or mental health or emotional condition of the data subject or any other person, or that the identity of another individual who had supplied the information would be disclosed or could be deduced, unless he had consented, or was himself a social work professional. The order makes it clear that as much as possible of the information should be disclosed as long as it does not prejudice the purpose for which it was obtained, which in general terms is to the benefit of the data subject.

Mr. Ashby

Will my hon. Friend give way?

Mr. Renton

With great respect to my hon. Friend, it will be for the convenience of the House if I move on. No doubt my hon. Friend will make his own contribution to the debate if he so wishes.

Mr. Ashby

Will my hon. Friend give way on that point?

Mr. Renton

No, I have already said that I want to move on. I will move to the financial services order and I am sure that my hon. Friend will make his contribution later.

The third order is the financial services order. This is made under powers in section 30(2) of the 1984 Act, and designates certain functions conferred by or under a statute relating to, among other things, the regulation of financial services. Data held for the purpose of discharging these functions are exempt from the subject access provisions of the Act in cases where the performance of those functions would be jeopardised by their application.

As I mentioned a few moments ago, it was recognised when the Act was passed that special provision had to be made to restrict access of individuals to data concerning them held in connection with the regulation of financial services, which might, for example, include information about suspected malpractice. If an individual were to use his rights of access under the Act to find out what information about him was held by the regulators, he could conceivably attempt to cover his tracks and make the conclusive uncovering of his malpractice more difficult. We have had to strike a balance here between the rights of the individual and the need in some circumstances for confidentiality, and we have thought it right to recognise the special responsibilities of the regulatory bodies in this area for identifying and taking action against financial wrongdoing. The House may like to know that a provision was inserted in the Financial Services Act 1986 to make it clear that self-regulating organisations and recognised professional bodies could be designated under the Data Protection Act in order that they might be exempted from subject access in respect of some of their data, as the present order provides.

The last of the four orders is the exemption order, made under powers in section 34(2) of the Act. This exempts from the subject access provisions of the Act any personal data consisting of information the disclosure of which is prohibited or restricted by the enactments and instruments listed in the schedule.

In each of those cases the Government consider that the statutory prohibition, or restriction on the disclosure of the information of which the data consist ought to prevail over the subject access provisions in the interests of data subjects or other individuals.

An example of where the interests of another individual ought properly to be taken into account would be adoption proceedings, where the interests of the natural parents are relevant as well as those of the adopted child.

The provisions listed in the order prohibit or restrict the disclosure of information relating to three broad areas—adoption records and reports used in adoption proceedings or kept in the possession of adoption societies and local authorities; statements and records of the special educational needs of children; and, in Scotland, information provided by reporters at children's hearings.

I should at this point refer to an issue which has been raised on this order by the Joint Committee on Statutory Instruments. The Committee has taken the view that there is a doubt about the vires of the second entry in part III of the schedule to the draft order, in that it refers to an Order-in-Council which I am informed is shortly to be laid before Parliament reforming the law in Northern Ireland concerning adoption, and which will bring that law into line with that in England under the Adoption Act 1976. It would obviously be inconvenient to have to lay another draft exemption order before the House after the Northern Ireland order has been made, which is why we sought to cover the point in this way.

I accept that the Committee's objection is arguable, although the point was carefully considered when the order was being drafted and the view was taken that, on balance, this drafting device was both intra vires and perfectly proper.

Nevertheless, as the Committee has expressed a doubt about it, I shall consider whether I should take a suitable opportunity of bringing forward another draft order to clear the point up when the Northern Ireland adoption order has been made.

In commending these orders to the House, I would say in conclusion that they have all been the subject of detailed and lengthy consultations between my Department and the other Departments in Whitehall primarily concerned with the subject matter; and they in turn have consulted widely among the relevant professional bodies and other groups outside Whitehall. The results of those consultations were carefully thought through before the orders were finalised and laid before the House. In accordance with the provisions of the Act, the Data Protection Registrar has also been consulted.

10.56 pm

Mr. Robin Corbett (Birmingham, Erdington)

The problem with the orders is that they compound what we consider to be the inadequacies of the Data Protection Act 1984; and that was the minimum that the Government needed to do to comply with the European convention that the Minister mentioned. It was far removed—nobody in their wildest dreams could accuse the Government of having this thought in their head—from any thoughts about a full-blown freedom of information Act designed to open doors and rip them from their hinges to let more daylight into our democracy.

We are a nation still consumed with secrecy. It is a national passion by those who govern. Who was it who said that something is secret because it is in a file marked "Secret"? That, in one sentence, is the whole issue.

We make and keep secret material affecting the everyday lives of individuals which should in no way be secret. Information is power and those with power—not just Government Departments, but the police, local authorities, health authorities and the rest — have amassed literally miles and miles of information about individuals.

If all that made it easier for us to sleep more safely in our beds, there might be some value in it, but it does not. It has to do with the still strongly held belief, especially under the Government, that Whitehall, and, in some areas, the town hall, know better than the rest of us and that we, poor dears, should not know what is being said about us behind our backs. These are not simply matters of passing interest; they can and do affect the judgments taken about people and make a real impact on their lives.

The Data Protection Act gave a general right to individuals to have a copy of information held on computer about him or her and a right to challenge information believed to be wrong and to have it corrected or erased. In essence, the orders contain that right and keep whole areas of computer records from individuals. We are not simply talking about factual records — someone's date of birth, address, height, or colour of eyes. The records covered by the orders are judgmental — people in the professions making judgments about the attitude, behaviour, and mental and physical condition of the individual concerned. The health and social work orders are examples of that.

I thought that it was generally agreed that part of the process of professionals effectively assisting the overcoming of problems was to share all available information. That work must be a partnership or it will not succeed. Even the contact of Members of Parliament with social workers is sufficient to show that changes in behaviour and attitude cannot be imposed by a professional; they are achieved in partnership between a client or patient and the professional concerned. If the information is not shared, if one party withholds information, there will not be trust and confidence, and progress will be the harder, if not impossible, to achieve. That must be especially true in the treatment of physical and mental health, yet the health order proposes to refuse access to information if its release would be likely to cause serious harm". I accept that there is some need for consideration of that factor, but not in the blanket manner proposed in the order. It is suggested that a doctor or dentist whose patient is the subject of information should be asked to judge whether it should be released. That is not good enough. We must guard against the likelihood, however extreme or rare it might be, that in certain circumstances doctors and dentists will make misjudgments in the course of their work — Members of Parliament do that — and that sometimes they will take risks. Yet under the order they will be given the power to say yes or no to a request for the information to be released.

The orders will do nothing to encourage those involved to make more professional, thoughtful and objective judgments. At the end of the day they know, to put it bluntly, that under these orders they can cover their backs. That may not happen very often, but it is a real risk that the orders do not take into account.

The orders block another path. The European convention, which the Act ratified, gives the right to correct or erase wrong information, but under the orders that right goes out of the window. It is not simply that the individual cannot see the information; he cannot see it to check whether it is inaccurate and critically touching upon him in a clinical treatment or diagnosis. As a way out, surely it would be better for a doctor or dentist not responsible for the clinical care of the patient concerned to make the decision about the release of information. In that way, the decision would be one removed and, therefore, perhaps be less partial. I hope that the Minister will at least consider that.

The Minister will know that the Royal College of Nursing has raised other objections to the health order because, in the last analysis, it shuts out of the decision whether to release information to other health professionals such as nurses, health visitors and midwives. In June, a Department of Health and Social Security circular proposed that lead health professionals be consulted, yet when the order came before the House that suggestion had been dropped. I am told that in the same circular it was suggested that doctors should refer to the manual records when considering the computer records and deciding whether they could safely be released. Manual records are not covered by the Act, which is a serious omission, but they form part of the material on Which a doctor makes a judgment on whether to release the information held on computer. I hope that the Minister will consider referring the matter to a doctor or dentist who is not responsible for the patient to whom the record refers, and that he will advise his right hon. Friend the Secretary of State for Social Services that the lead health professionals should be consulted before a decision is taken.

For how long does the restriction of the withholding of information last? An application may be made under the order and the doctor may decide that it is not safe to allow the patient to see the information. for how long will that continue—one month, three months, six months or 12 months? Would it not be better, as the Royal College of Nursing suggested, when it is felt that serious harm would arise from immediate disclosure to set a time limit of six months and then another appliation can be made?

Similar arguments apply to the social work order. It is those who are involved in making the judgments, likely to prejudice the carrying out of social work by causing serious harm to … health or emotional condition", who will decide whether that information can safely be released.

Again, I say to the Minister that that cannot be right. I can foresee a need to check or reassess some cases, however rare, but I am concerned that this provision again runs the risk of abuse and will err on the side of secrecy for its own sake. Would it not be better for a local government officer who is not directly concerned with the case to make the decision whether to release the information? The same applies to the voluntary agencies. At least it gives the promise of impartiality.

How can a social work officer who has been involved with an extremely difficult and intractable case make a clear and proper judgment on whether to release information on request? In the real world—I am sure the Minister is aware of this—it is asking too much of the worker.

Similar criticisms can be made of the miscellaneous subject access exemptions order, which relates to adoption and special education. No judgment is required. The order simply says that data are exempted from the provisions of the main Act in the interests of protecting the subject of the data himself or some other individual. I agree that we should consider this matter, but I am amazed that it can be proposed by a Government who crow about the virtues of the main Act that this should be drawn so widely. How can it be suggested that such a blanket provision is needed? It does not clearly define what grounds will be taken into account. There is no facility for the individual to challenge or seek to correct or erase wrong information, and once more the professional making judgmental comments is relieved of any responsibility to have those judgments tested for truth and accuracy.

Perhaps the Minister will tell me what guidance it is proposed to issue to those concerned with adoption and social work to help them in making these judgments. Is there not some way in which consideration can be given to a third party? Can we not find a simple and straightforward way of enabling the legal representative of the individual involved to see the information and to know the grounds on which it is to be withheld?

The Minister and the House will know that the Education Act 1986 gives parents, although not pupils, the right of access to school records. Does the order which concerns special education cancel that right?

On the face of it, the order concerning financial services is slightly alarming. It exempts material under 29 Acts and three orders—in the main the newly passed Financial Services Act 1986. It will come as no surprise to the House to hear that the Opposition were unhappy about the timid, pussyfoot approach of that Act to City scandal and finding a means to deter and combat it. The order does little to dispel those concerns. It worries me that it may, yet again, send the wrong signal to the City.

I understand that, under the orders, a doctor, a dentist, a local authority or a health authority can, when asked by someone whether information about them is held on computer and whether they can have a copy of it, reply that they are not obliged under the Data Protection Act 1984 to disclose such information. On the face of it, that is a factual statement, but it is, to say the least, extremely economical with the truth. The applicant is not told whether information about him or her is held on computer. The applicant can simply be told that the authorities will not—and do not have to—say whether information about him or her is held. That is most unsatisfactory.

I should like the Minister to give an assurance that such a cover-up form of words will not be used in regard to the orders and that the holder of information will say whether information is held and give reasons why it cannot be given if, indeed, it cannot. That at least has the merit of being a more adequate explanation. Some of us were slightly aghast when we thought we heard the Minister say that, in some cases, it would be more dangerous to say that than to provide the information. If that really is the Government's approach to the orders, we might as well go home.

Section 21 of the Data Protection Act gives a person who is denied knowledge of whether personal data are held on him or her and, when a copy of such information is refused, the right to seek a court order to obtain it. The orders make withholding information relating to social work, mental or physical illness, special education needs and adoption legal.

Will such refusals be open to challenge in the courts? I assume that they will, but that merely underlines what I have already said about the need for some informal third party assessment of whether information should be withheld in the interests of the person concerned. I believe that the courts will make even more difficult a situation that is likely to be difficult enough.

I am aware that there is a right of appeal to the registrar and that medical advisers and other professionals will be available to him. That can be helpful and certainly appears to be more user friendly than the courts, but there should be some less formal independent third party method of decision. I hope that the Minister will consider that and let me know his conclusions.

I shall not advise my right hon. and hon. Friends to vote against the orders, but they remain narrow, restrictive and contrary to the demands of a growing number of people for more, and more open, access to information, which is held manually or on computer by people in positions of authority, over important parts of our lives.

11.15 pm

Mr. Kenneth Warren (Hastings and Rye)

Despite the statement of the hon. Member for Birmingham, Erdington (Mr. Corbett) that there will be no vote on the orders, should have been delighted to vote for them. I believe that we are dancing the often organised late night minuet around the Official Secrets Act. In terms of the progress of my hon. Friend the Member for Aldridge-Brownhills (Mr. Shepherd), I hope that the orders will be approved by the House. We are facing the traditional problem of Her Majesty's Governments, whichever party is in power, of secrecy and what it is worth in terms of the protection of our citizens.

For many years I was involved in the Council of Europe studying the problems of data protection. I was chairman of its parliamentary committee on the freedom of information. Therefore, I am concerned not only about the protection of our citizens but about how we can make available that material that should be made available to our citizens.

Having listened to the debate, and, with great respect, to my hon. Friend the Minister of State, Home Office, I rather felt that nobody in his Department had read the work in Sweden or the United States on these matters. I got the impression that, like all good engineers, the wheel was being invented again. I should like an assurance from the Minister that sufficient consideration has been, and will be, given not only to those laws that have been passed in those other countries that share the desire that I am sure he shares for the maximum freedom of information, but that that will be reflected in orders affecting the Data Protection Act 1984.

I should like to put some questions to my hon. Friend. I do not expect answers tonight, but I should like answers in due course, at his convenience; unlike the questions, that I asked of a Minister in a recent debate, which I am still waiting on and which I am still pursuing.

The 1984 Act states that a register is public and available in all public libraries. I hope that a copy will be made available in the Library of the House of Commons.

The Data Protection (Subject Access Modification) (Social Work) Order 1987 refers to the serious harm to the data subject or some other person, and I should like to know who will decide what is serious harm and for how long that serious harm will be considered to be in place.

The Data Protection (Subject Access Modification) (Health) Order 1987 provides for access to data held by health professionals. The term "health professionals" should be spelt out in detail because it covers a multitude of virtues and sins. It needs to be stated exactly who health professionals are, what qualifications they have, what rights they have to retain information, and over what period of time.

In respect of the Data Protection (Regulation of Financial Services etc.) (Subject Access Exemption) Order 1987—I love that word "etc."; clearly the lawyers were paid by the inch, if not by the metre—it says who is likely to be prejudiced by the discharge of the functions, but who decides those matters? We do not want to see a great panoply of legal effects which only give prosperity to lawyers.

Mr. Ashby

And why not?

Mr. Warren

My hon. Friend asks why not. The problem with our laws at the moment is that they not only grow too fast, but that lawyers' fees grow exponentially with them. As an aside it is high time that the lawyers' fees were examined in detail, particularly why they charge so much for such limited services.

I now question the considerations that arise in the terms of the Data Protection (Miscellaneous Subject Access Exemptions) Order. I am concerned about the problems that can arise about disclosure without authority. In that connection I should like to know to whom the information would be disclosed, and what constraints would be put on the persons to whom it was disclosed not to pass on the information?

Although I regard the orders as a movement forward in what we all want to see—the protection of data—I hope that the issue will not be clouded by the greater requirement of more openness in government.

11.20 pm

Mr. Archy Kirkwood (Roxburgh and Berwickshire)

Since elections always bring casualties, I begin by noting the absence of the remarkable former hon. Member for Oxford, East, Mr. Steve Norris. Had he been re-elected, I am sure that he would have been here. He assisted me as a sponsor of the Access to Personal Files Act 1987, as it eventually became, during the course of the private Member's Bill procedure. During that time he was a great help to me. He was a passionate advocate of freedom of information in all its various aspects. He became a great expert in the detail of matters exactly like this. I, for one, miss him greatly.

Having been through the rigours of trying to get my private Member's Bill through the Home Office, which involved various aspects straddling different Departments, I fully appreciate the difficulties facing the Minister. Indeed, the former Minister of State, Home Office did so well in handling my Bill that he was promoted to Chief Whip. I say seriously that I understand that there are technically difficult matters that are officially outwith the Minister's purlieu and they are difficult to cope with. It is against that background that I return to the question I asked during my intervention. It is a technically complicated question but it is an important one. I gave him the wrong scent by referring to general practitioners. The Minister will know that a draft DHSS circular that was issued in June this year, alongside the draft of the health order, suggested that a data user's obligation was only to consult the health professional, not to withhold information indefinitely until a health professional gave a final decision. Therefore, where the health professional failed to reply within 40 days, which the House will know is the normal time allowed for responding to subject access requests, the data user would, in my opinion, then be obliged—that is an important word—to give access to the health data in full. If that is the case, my reading of the order is wrong. However it is an important point. People other than ourselves read these debates and it is important for the Minister to clarify that. I hope that he will now do so.

Mr. Renton

I thank the hon. Gentleman for his indulgence on this complex matter. The straightforward answer to the specific question posed by the hon. Gentleman in his intervention is no. If the doctor is so dilatory that the 40-day period is exceeded, the data user is in breach of his obligations under section 21(6) of the Data Protection Act 1984. His recourse is the right to go to court or complain to the registrar. The health order and the other orders we are debating do not affect that right.

Mr. Kirkwood

I am grateful for the clarification, as I am sure the House will be. I regret that, but at least the debate can now continue on the basis of an accurate interpretation of the order.

I wish to make three points during the course of this important debate. My general response to the orders is that there are good aspects to them that I recognise and welcome. I congratulate the Government on resisting pressure, from some medical circles. I am glad that the Parliamentary Under-Secretary of State for Health and Social Security has seen fit to attend this important debate. She will know that there has been pressure from some in medical circles to seek total exemption for medical records. The Government were right to resist that pressure. At this year's British Medical Association conference motions of censure were tabled criticising the BMA council for having accepted the idea of modified access to health records rather than demanding total exemption. I am pleased to say that those motions were overwhelmingly rejected.

I welcome the fact that under the health and the social work orders the test for withholding informatiion has been changed to "serious harm". That is a stricter test than either of those proposed in the Department of Health and Social Security consultation paper. At that stage in the consultation process it was proposed that the test should be that the information would be likely to cause "actual harm" or "actual harm or distress". The test of "serious harm" now contained in the orders was the one that I proposed in the Access to Personal Files Act and I am glad that the Government have accepted that principle.

I welcome the fact that social workers' provisional judgments have not been exempted from access in the social work order. The proposal in the DHSS consultation paper would have exempted them, which would have meant that all the provisional judgments would have been withheld until after a decision based on them had been made, by which time it would have been too late. The 1983 DHSS circular on access to manual social work records which has been followed by many authorities allows provisional judgments to be exempted. The order will lead to a more positive line than that taken by many at the moment. That, too, is welcome. I hope that the social work regulations on manual records under the Access to Personal Files Act will follow the more positive line rather than that taken in the 1983 DHSS circular.

Finally, I welcome the fact that the protection for the identities of third parties will not prohibit the disclosure of the names of doctors, social workers or other professional staff involved with the data subject. This is a lesson that seems to have been learnt from the Access to Personal Files Act which protected the identities of contributors to records except for those acting in a professional capacity. The Data Protection Act itself does not make that distinction, and without the present provisions, computer users would be obliged to suppress the names of doctors and others who had treated the patient.

My main criticism of the orders is political rather than technical. It will come as no surprise to the Minister that I am disappointed that there is no access to manual records—on health in particular. The arguments that we put forward last year have been sustained and are even more important than they were then because of the overwhelming public support for such access. Over 140 national organisations, the majority of them with an interest in health records, backed the Access to Personal Files Act last year. Professional bodies—notably the Royal College of Nursing, the Royal College of Midwives and the Health Visitors Association—also backed the Act. A recent opinion poll—if evidence were required—commissioned by the Data Protection Registrar found that more than eight out of 10 people thought that the Data Protection Act should apply to manual records. That is a substantial body of public opinion. The survey showed that 86 per cent. of people thought that medical records should "always" or "usually" be available. There is overwhelming public support for access to manual health records. The distinction between manual and computer records is completely arbitrary and should not be the basis for deciding whether we have a right to safeguard ourselves against mistakes or unfair decisions. Why should our right to protect ourselves depend upon whether the organisation which holds records on us can afford a computer?

If I understand the health and social work orders correctly, I am worried that people may have no way of knowing whether information about them has been deleted before they are given access. This June, the draft DHSS circular suggested that people would get a specially written report based on the computer printout, but would not necessarily get the printout itself. There is no objection to a special report, if it is in addition to the printout, not instead of it. Indeed, it would be extremely welcome. But it is not acceptable as an alternative, and denying individuals access to the original information will generate suspicion, even in cases where people have received full information. I believe that people should be told whether information about them has been withheld so that they can, if they wish, appeal against that decision. However, it appears that they will not be told.

If that is right, doctors and social workers will have an enormous amount of freedom to withhold information, even where the serious harm test does not apply. Of course, there is anxiety about telling people that information has been withheld, because of the risk of serious injury. Fear itself causes great distress. My solution in the Access to Personal Files Act was to allow a six-months delay rather than permanent withholding, which would allow the doctor to say, "Wait until your condition improves a little and then we will see whether we can discuss things with you." Deferred access could get over the problem created by the order.

The hon. Member for Birmingham, Erdington (Mr. Corbett) mentioned the fact that the prime responsibility for decisions on access should be taken only by doctors or dentists, according to my interpretation of the order, although at times it may be more appropriate for other professionals to take those decisions. The draft order that was circulated in June gave responsibility to the health professional who is currently or was most recently responsible for the clinical care of the data subject in connection with the matters to which the information … relates. The final order has deleted that and given prime responsibility to doctors and dentists. In rural areas and in constituencies such as mine, the categories of medical practitioner that are excluded—nurses, midwives and health visitors—are largely or solely responsible for a patient's care and are therefore accountable personally for the entries that they make on a person's record. Confining the right to disclose solely to medical practitioners would make the other health professionals inhibited about exactly what they recorded. If the order was passed unamended, information recorded by a midwife, nurse or health visitor could be passed on or withheld without their consent or even their knowledge. Such a narrow definition of "health professional" is not only unsound, it sets a worrying precedent.

I cite child abuse cases as a special worry in this area. Health visitors keep records from information obtained from parents and the child—often confidentially obtained from each other. They are generally not revealed, unless required in court cases. However, under the terms of the order, it will be possible to reveal those records outside court, perhaps without the health visitor's knowledge or consent. That raises potentially serious legal problems. I support the claim by the Royal College of Nursing that the order, insofar as it affects nurses, is very restrictive, produces complex access procedures and puts the medical and dental professions in a central position which is not entirely acceptable.

The fees that will be charged under these provisions may be prohibitive for many people, and I hope the Government will give careful consideration to that aspect. They have recently announced that the maximum fee for an application will be about £10. In fact, people may have to make multiple applications and thus have to pay several separate fees simpy to obtain the data held on them by a single computer user. May we have an assurance that steps will be taken to ensure that access is not restricted because of the fees that are charged, particularly to people on lower incomes?

I give a broad welcome to the orders, although I fear they will not achieve everything the Minister claimed for them. However, they can be regarded as a small step in the right direction, and, for what they are worth—with the single exception of the way they will impact on nurses, midwives and health visitors—I give them a cautious welcome.

11.36 pm

Mr. Richard Alexander (Newark)

Hon. Members will have welcomed the comments of the hon. Member for Roxburgh and Berwickshire (Mr. Kirkwood) about our former colleague, Mr. Steve Norris. We miss him and, particularly on the Conservative Benches, look forward to having him back with us soon.

I wish to draw attention to the concern felt by the Royal College of Midwives about the implications for its profession of the Data Protection (Subject Access Modification) (Health) Order. This subject was mentioned by the hon. Members for Birmingham, Erdington (Mr. Corbett) and for Roxburgh and Berwickshire.

Article 4 in effect restricts to medical and dental practitioners the ability to supply information. That at first sounds reasonable, but when one considers that it follows that a midwife will have no right of access to records held on a computer, that cannot be considered satisfactory. He or she will need the medical practitioner's consent for access to those records, and that medical practitioner could withhold them.

Midwives need access to records, which are an essential part of caring for the patient. Preventing them from having those records will make it difficult for them to keep their patients informed and involved in their own health care. They are not simply nursing assistants to doctors; they are qualified independent practitioners in their own right, and they often give total health care to their patients.

In such circumstances they are totally responsible; as independent contractors, they are booked by mothers for a complete period. The doctor gets involved, but they have total care of the client or patient. It is important, therefore, that those who are involved professionally in the care of the mother should have access to that mother's records so that they can give the best possible advice about what needs to be done.

The hon. Member for Erdington mentioned—and I am instructed on the subject—that consultations on the matter took place for a couple of years and that it was understood that the instrument would deal with this issue of access by midwives. But, suddenly, without further consultation, they have been excluded.

I hope that my hon. Friend the Minister will table an early amending order providing that in article 4(6)(a) after the words "medical practitioner or dental practitioner" there shall be added the words "or practising midwife or midwives." I look forward to hearing that my hon. Friend agrees with this, and hope that we shall have an amendment soon.

11.39 pm

Mr. Bob Cryer (Bradford, South)

I am most grateful for the opportunity to contribute to this debate and I shall be brief.

I chair the Joint Committee on Statutory Instruments and I want to draw the Minister's attention—he has mentioned it — to the unanimous report of that Committee. That Committee, in common with all Committees, reflects the strength of the political parties in the House.

Article 2 of the Data Protection (Miscellaneous Subject Access Exemptions) Order states: There shall be exempted from the subject access provisions any personal data consisting of information the disclosure of which is prohibited or restricted by the enactments and instruments listed in the Schedule to this Order". I know that the Minister is aware that the third part of the schedule relates to: Any enactment contained in an Order in Council made under the Northern Ireland Act 1974(b) and making provisions corresponding to section 51 of the Adoption Act 1976. The Joint Committee asked for a memorandum from the Minister's Department and that memorandum made clear that the draft Order-in-Council that the Department has in mind for this part of the schedule will: almost certainly not be made by the time this draft Order (if approved by Parliament) is made, although it is hoped that it will be made shortly thereafter. The question of ultra vires concerns whether the Minister has power to include in the schedule a reference to an order that in fact is not yet made. The powers that the Minister invokes to make the order do not, for example, include section 41 of the Data Protection Act 1984. It should be noted that enactment is defined in that section as including: an enactment passed after this Act That section is referred to in the memorandum provided by the Minister's Department, but it is not a power that is listed in the order and it is not a power that the Minister has chosen to invoke in presenting the order to the House. The Minister depends upon section 34(2) for that purpose, but it does not allow any provision to be included for an enactment that has yet to be passed.

Delegated legislation represents an extremely wide area of power for Ministers. The House recognised that and set up the Joint Committee on Statutory Instruments to act as a safeguard. Indeed the Joint Committee has reported specifically on this matter. I am sure that hon. Members from both sides of the House would look askance at an order that referred to an order that has yet to be made and has not yet been considered by any component body of the House.

The Minister suggested—it is clear that he regarded it as important enough to refer to it—that he might be looking at another draft order to clear up any doubt. That is a messy proposition because it means that people must deal with two orders, and it also means another 85p to clear up an order that is, in our view, defective. I hope that the Minister shares that view.

I believe that the wisest procedure is to withdraw this order, remedy any defect and then present the corrected order to the House. I am sure that that would gain approval.

Mr. William Cash (Stafford)

I am a member of the Joint Committee and this matter was referred to us by our legal adviser. What the Chairman has said is absolutely accurate. I believe that it is quite an extraordinary state of affairs that we should be faced with an order that is, as the Chairman has described, patently ultra vires. I should be interested to learn what my hon. Friend the Minister has to say, and I hope that he will remedy the matter at the earliest opportunity.

Mr. Cryer

I am grateful for that intervention. The Minister will see that it is not my own view but the view of the Committee which reached a unanimous verdict. That Committee was established by the House to carry out the function of drawing attention to cases like this. We were legally advised; we did not produce this conclusion without the most serious advice. We think that the order is not well laid out and that that article is ultra vires. With the Committee's report ringing in his ears I hope that the Minister will take proper account of these remarks.

11.44 pm

Mr. William Cash (Stafford)

Apart from the point that I raised in the intervention, my concern arises on the Data Protection (Subject Access Modification) (Health) Order 1987, article 2, where the definition of a health professional raises some odd matters. The schedule deals with the statutory derivation, where applicable, and includes the Medical Act 1983, the Dentists' Act 1984 the Opticians Act 1958, the Pharmacy Act 1954 and the Professions Supplementary to Medicine Act 1960, among others. It then deals with another series of categories which do not have any statutory derivation. Nowhere is there any recognition of those who practise complementary or alternative medicine and who, by any stretch of the imagination, have to be regarded as health professionals.

Are we not living in a real world where people today, tomorrow and yesterday make use of chiropractic, acupuncture and other facilities provided by people who are not necessarily doctors or persons covered by the Professions Supplementary to Medicine Act? These are the facts of life which are not even remotely recognised under the definition of health professionals. Many thousands throughout the country and many hon. Members receive the assistance of persons who are not, under the terms of the order, described as health professionals but who on a common sense basis are health professionals.

I ask the Minister to consider that question and to give me an answer. If these people who are administering chiropractic, acupuncture, osteopathy and so on are providing advice and assistance to the general public, why are they excluded from the definition of health professionals?

I do not think I need make the case any more. Will the Minister be good enough to consider this question? The order is about the protection of the public. That means patients. There is a reference to people who are not statutorily recognised like clinical psychologists, art therapists, music therapists or Scientist employed by such an authority or Board as a head of department". Why does the order not include chiropractors, acupuncturists or osteopaths who are providing a sensible service for the benefit of the public?

11.48 pm

Mr. Harry Cohen (Leyton)

I shall introduce my Data Protection (Amendment) Bill under the ten-minute procedure next week. That will be a substantial improvement on the Government's approach which my hon. Friend the Member for Birmingham, Erdington (Mr. Corbett) rightly described as narrow and restrictive. Ironically the Data Protection Act has proved not only unwieldy to business but has also given widespread exemptions, particularly in the public sector, denying individuals access to their own records. There should be fewer exemptions and wider and simpler rights of access for individuals to computer records held on them. That is for next week.

I want to raise several points about the order dealing with financial services. First, why has it taken the Government so long to produce the order? How can Parliament be expected to inspect in such a short time the implications of probably over 200 functions relating to 30 Acts? How can Parliament be satisfied that the order does not take away data subject rights? Why cannot the order at least expire in, say, one year's time and then be reintroduced? That would give us some time to see how it works in practice.

Secondly, section 28 of the Data Protection Act allows subject access exemption for the purpose of the prevention or detection of crime, the apprehension or prosecution of offenders and the assessment or collection of any tax or duty. That is a pretty substantial exemption. Consequently, the order must cover other exemptions of personal data held for different purposes. Some of those purposes may be sensible; but why should all such personal data be exempt so that the subject cannot gain access to them? It seems unnecessary.

Everyone would favour the aim of ensuring that only honest financial operators are in positions of trust. I do not believe, however, that wide exemptions are the best way to achieve that aim. The Government have put no test into the order of whether subject access would prejudice or cause serious harm to the function being carried out by the financial regulatory body. It merely states that personal data concerned, however vaguely, with that function may be exempt. How can the accuracy of personal data be checked if the data subject has no access? There should be safeguards, particularly if accusations are made that inaccurate personal data have been put on file maliciously.

The Minister said that the data registrar had been consulted, but he did not say what the registrar said. He may well have been critical, and I think that hon. Members should know whether he was, and, if so, what his criticisms were.

In the case of the health and social work order, there is again a shortage of time in which to implement complex measures. Local authorities and health authorities have only about 10 days for the purpose, although the Government have had two years to produce the orders.

Hon. Members have referred to the provision in regulation 4(5) of the order about the most appropriate health professional. Let me quote from a letter sent to my hon. Friend the Member for City of Durham (Mr. Steinberg) by Mr. Bernard J. B. Kat, who was on the inter-professional working group on access to personal health information. He writes: We see no good reason why the rights of access introduced by the Data Protection Act should not extend to health records but we need the opportunity to bring about that change in practice. He also goes into the definition of a health professional in regulation 4(6), particularly the narrow definition in part 4(6) referring to a medical or dental practitioner. He says: The health professions are generally in favour of people having access to their health records. However, some members of the medical profession, particularly hospital-based consultants, seem very determined to limit people's access to health records … Our fear is that the substitution of 'medical and dental practitioners' for 'health professionals' as the decision makers in the Order will have a significant and detrimental effect on the patients' access to their records. He says: presumably it was done to satisfy the sectional interests of certain hospital-based medical consultants. The letter concludes: It would be very regrettable if this order were to set a precedent of making access difficult rather than easy. Those are serious allegations by a person who gave advice to the Government, and the Minister must explain why that advice was disregarded.

What happens when the medical and social work personal data reside together? There could be difficulties about who has the final say, particularly if the parties disagree. There are two possibilities in such circumstances. One is where the social work department consults the health professional. The department may say that it does not agree with the health professional's advice on the matter and may decide to release the personal data. In that case the data user, the social work department, will have the last say, but that could be a recipe for future conflict between the various professions that have to work together, and the data holder might not in future share his information with the social worker.

That is how consultation would work, but the other way in which it could work when there is disagreement is for the health professional to say, "You will not supply the information that constitutes the data." That would be not consultation but refusal of permission from the medical professional. Who will have the last word in the event of disagreement? The Minister must be clearer about that.

The consultation process will not be uniform because a health professional in Leyton may give a different decision from a health professional in Ilford about a similar case. One may grant subject access and the other may refuse to grant it. That could have serious implications. I am worried that insurance companies may force subject access and that it will become well known that medical data that will cause serious harm to the data subject will be exempt. By inference, personal data that will not cause serious harm will be available to the data subject. An insurance company may use this and say to the data subject, "Before we give you a policy, apply to your doctor for subject access and show us the results."

By definition, "serious harm" people will be poor risks and the insurance companies will have no interest in them. As "serious harm" depends on consultation with the health professional, and as that can be erratic and varied from area to area, some poor risks will be unjustifiably categorised and unfairly labelled as poor risks. I hope that the Minister will be able to respond to my points in the House or by letter.

11.58 pm

Mr. Renton

I thank all hon. Members who have contributed to this short, stimulating and interesting debate. In particular, I thank the hon. Member for Roxburgh and Berwickshire (Mr. Kirkwood), who I regret is not in the Chamber at the moment, and the hon. Member for Leyton (Mr. Cohen). Although the hon. Member for Leyton has eaten into most of the time in which I had hoped to answer the questions posed in the debate, he is none the less one of the aficionados in this subject. He always speaks with great seriousness and expertise on the subject, and I am delighted that he was able to make a contribution. I certainly support the remarks made about Steve Norris, and the same must be said about Mr. Robert Kilroy-Silk. They are two former hon. Members whom we miss in the House. They were great experts on personal data and data protection.

I was very disappointed with the speech of the hon. Member for Birmingham, Erdington (Mr. Corbett) from the Opposition Front Bench. It was very shortsighted. If, heaven forfend, the hon. Gentleman was ever on the Government Front Bench occupying the position that I have tonight, I believe that he would be moving the data protection modification orders in precisely the same terms and in the same detail as I did tonight. In the Data Protection Act 1984 it is recognised that there are certain areas—health records are the main area—where totally unfettered access of the individual to his computer data cannot be given, largely for the individual's sake.

To encapsulate the broad objective of the legislation, it is to provide the maximum degree of access with the minimum safeguards necessary in the public interest and in the interests of the individual. That is the spirit behind the orders.

The hon. Member for Erdington and the hon. Member for Leyton raised points about the health order. In response to them I can state that the doctor or dentist's opinion is not legally the last word. If the data subject disagrees with the withholding of access, he has the right under section 21(8) of the 1984 Act to go to court and challenge the decision or to go to the Data Protection Registrar. In response to the question raised by the hon. Member for Erdington about what guidance is to be given to social workers, I can state that guidance has already been given as follows: withholding information should be exceptional, the local authority should identify someone in senior management to decide whether information should be withheld, and the authority's lawyers should normally be consulted.

I thank my hon. Friend the Member for Hastings and Rye (Mr. Warren) for stating very warmly that the legislation is a movement forward. If I cannot answer all his points tonight, I shall try to answer them later or ask my colleagues at the DHSS to answer, if their expertise is appropriate.

We are well aware of developments on the Continent in relation to data protection, and the Data Protection Registrar has travelled widely. The register of data users and the purposes for which they hold information has been published and is available in main public libraries. My hon. Friend the Member for Hastings and Rye also asked about the constraints on the disclosure of that data. The point is that the orders deal with access by the data subject, not disclosure to third parties. The Data Protection Act 1984 deals with disclosure by requiring data users to register in general terms people to whom they disclose data.

Mr. Warren

Will it be possible for that information to be made available in the House?

Mr. Renton

I must get on, and my hon. Friend must forgive me.

I appreciate the importance of the points made by my hon. Friend the Member for Stafford (Mr. Cash) and the hon. Member for Bradford, South (Mr. Cryer). I have already said that I shall consider making a new order dealing with a Northern Ireland adoption order when that order has been made. I understand the point made by the Joint Committee, and I dealt with that at some length in my opening remarks. I cannot accept that the order is defective, as the entry in question will not have effect unless and until the Northern Ireland adoption order is made.

Finally, I want to confirm how strongly we feel that the Data Protection Act 1984 is an important piece of legislation in terms of the responsibilities that it places on data users who use the automatic processing of personal information, and the protection that it gives to individuals against misuse or unauthorised disclosure of information stored about them on data systems. It will, of course, take time for the system established by the Act to become fully operative. The implementation of the Act has not been without its problems, but I believe that those are being overcome and that good progress is being made in meeting the objectives of the legislation—

It being one and a half hours after the commencement of proceedings on the motion, MR. DEPUTY SPEAKER put the Question, pursuant to Standing Order No. 14 ( Exempted Business).

Question agreed to.

Resolved, That the draft Data Protection (Subject Access Modification) (Social Work) Order 1987, which was laid before this House on 21st October, be approved.

c905
1. DATA PROTECTION 74 words
c905
2. HOUSE OF COMMONS (SERVICES) 76 words